Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Apple really log every app you run? A technical look

blog.jacopo.io

Post reply on HN
Print view View original

71–80 of 355 posts

Re: Does Apple really log every app you run? A technical look

#71

Post by miles »

m463 wrote: post #35

> As you probably have already learned during Apple’s OCSP responder outage, you can block OCSP requests in several ways, the most popular ones being Little Snitch Uninformed advice - apple prevents little snitch from blocking this traffic in big sur.

>> you can block OCSP requests in several ways, the most popular ones being Little Snitch

> Uninformed advice - apple prevents little snitch from blocking this traffic in big sur.

You can prevent Apple from preventing Little Snitch from blocking that traffic: https://tinyapps.org/blog/202010210700_whose_computer_is_it....

Re: Does Apple really log every app you run? A technical look

#73

Post by istjohn »

m463 wrote: post #35

> As you probably have already learned during Apple’s OCSP responder outage, you can block OCSP requests in several ways, the most popular ones being Little Snitch Uninformed advice - apple prevents little snitch from blocking this traffic in big sur.

Keep reading.

>If you use macOS Big Sur, blocking OCSP might not be as trivial.

Re: Does Apple really log every app you run? A technical look

#74

Post by [deleted] »

IfOnlyYouKnew wrote: post #45
josephcsible wrote: post #10

Earlier quoted context omitted.

> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816

You also didn't ask them to put a clock in the top right corner. I hope that gets the same level of righteous exasperation. (Just discovered MacOS includes at least two fonts and a printer driver I never asked for. How dare they?)

[deleted]

Re: Does Apple really log every app you run? A technical look

#75

Post by kenniskrag »

throwawayg123 wrote: post #54
the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

Wait. Is it not common knowledge that Android and iOS log every application you open down to the exact millisecond you open and close them? Is it not common knowledge how telemetry works for the operating systems? They generally batch up a bunch of logs like this, encrypt them, compress them, and then send them to the mothership (hopefully when you're on WiFi).

first compressed and then encrypted. A good encryption is indistinguishable from random data.

Re: Does Apple really log every app you run? A technical look

#76

Post by olliej »

smnrchrds wrote: post #53
olliej wrote: post #40

Earlier quoted context omitted.

I feel Apple has done privacy well in so many cases, that the way this works is really disappointing :-/

Apple has done a fantastic PR job regarding privacy. I am more skeptical about the status of actual privacy given their iMessage situation and now this.

Their iMessage situation?

Re: Does Apple really log every app you run? A technical look

#77

Post by delvinj »

m463 wrote: post #37
josephcsible wrote: post #10

Earlier quoted context omitted.

> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816

It's worth noting that on ios you can never block anything - just have to put up with it.

You can still block access by host by using an HTTP proxy like Fiddler or Charles.

Settings > WIFI > Proxy

Re: Does Apple really log every app you run? A technical look

#78

Post by olliej »

ghayes wrote: post #56
olliej wrote: post #40

Earlier quoted context omitted.

I feel Apple has done privacy well in so many cases, that the way this works is really disappointing :-/

A better privacy solution would be to sync revocation lists every so often (and, if you must, right before opening a new app). Is there any privacy-preserving reason to not go this direction? How often would you expect certificates to be rescinded? You could also use a bloom filter to significantly reduce the false-positive rate.

CRLs are how we dealt with OCSP in the browser, and I feel like those must surely have more insanity than the Developer ID certs

Re: Does Apple really log every app you run? A technical look

#79

Post by _qulr »

saagarjha wrote: post #68
_qulr wrote: post #59

Earlier quoted context omitted.

> There is no information on how often the validation happens. I wrote a blog post about this. My analysis indicates that Developer ID OCSP responses were previously cached for 5 minutes, but Apple changed it to half a day after Thursday's outage, probably to reduce traffic: https://lapcatsoftware.com/articles/ocsp.html

5 minutes is an absurdly short cache time…

Pure speculation from me, but my guess is that the intention is check an app on every launch, and the 5 minutes is there just to lower the chances of DoS from an app getting repeatedly launched for some reason.

Re: Does Apple really log every app you run? A technical look

#80

Post by fiddlerwoaroof »

the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

Isn’t OCSP an open standard for handling certificate revocations? The standard specifies plaintext, because the standard can’t assume that the client has a way to form an encrypted connection to the revocation list.
Post reply on HN